CVE-2021-36029 — Improper Authorization in Magento Community-edition

CWE-285 — Improper Authorization4 documents4 sources
Severity
7.2HIGHNVD
CNA9.1
EPSS
3.5%
top 12.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Magento Community-editionAdobe Magento CommerceAdobe Commerce+2 more
Timeline
PublishedSep 1
Latest updateMay 24

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5adobe/magento_commerceunspecified — 2.4.2+3
▶Packagistmagento/community-edition2.4.2-p1 — 2.4.2-p2+1
▶NVDadobe/adobe_commerce2.3.0 — 2.3.7+2
▶NVDadobe/magento_open_source2.3.0 — 2.3.7+2

Patches

Patch: helpx.adobe.com ↗Patch: helpx.adobe.com ↗

🔴Vulnerability Details

3
OSV
Magento improper authorization vulnerability↗2022-05-24
▶
GHSA
Magento improper authorization vulnerability↗2022-05-24
▶
CVEList
Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution↗2021-09-01
▶
CVE-2021-36029 — Improper Authorization in Magento | cvebase